New York City to Consider Banning Sale of Cellphone Location Data - <AUTHOR> https://www.nytimes.com/2019/07/23/nyregion/cellphone-tracking-location-data.html <comment><USER2> It's wild how common this is, especially on Android, and how little people know about it. Those free apps you enjoy? Many of them make money by shipping with a 3rd party SDK that records your location (among other identifying information), collates it with other identifying information, and feeds it into the massive real time ad-tech system that powers large swaths of the internet.

<comment><USER3> Too bad your location is still sold by your cellular provider even if you delete all those apps.

<comment><USER4> > AT&T, T-Mobile and Verizon have pledged to stop selling location data to > brokers who may sell the information on the black market.

Most of them stopped according to the article.

<comment><USER5> Pledging to stop and stopping are two very different things.

Pledging to stop is pretty standard operating procedure whenever bad privacy practices cause a PR stink, but it's quite common to see the same company with the same PR stink a year or two later. Pledges to stop often have more to do with the media cycle than any actual intention to stop.

<comment><USER6> Yeah, a good example of this is Pepsi pledging to remove Brominated Vegetable Oil from their drinks in response to a campaign by a young student that caught media attention. Years later, they never did any such thing.

<comment><USER7> Which really makes no sense when you think about it because it's already illegal in Europe and Japan so might as well just remove it altogether.

<comment><USER8> It all depends on the monetary difference doing so makes. If it's significantly cheaper, then they will continue to include it for legal markets.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Just let me profit or opt-out of the sale! Some how the mindset/unspoken agreement/TOS-spoken agreement that I have to "pay" with my personal data to use these products has become too commonplace. It doesn't have to be much, but if I were allowed to generate an extra $20 a month that'd be great! I already use Google Rewards, and at this point that's the only "surveys" I get.

If I play fantasy futurologist for a second, it would even make for some interesting economics. Underrepresented groups for a particular analysis could pay more, because those groups' data is rarer. A straight, white, male techie is probably a saturated market, so I wouldn't generate much, but a Hispanic woman's could be more valuable.

<comment><USER10> These companies use your data to make money. Paying you would mean they'd have to make more than they pay you from the addition of said data.

Today, I suspect the benefit of having said data is probably unknown. This data is probably only valuable in aggregate to determine trends.

Showing you a random advertisement vs an advertisement based on the page info vs an advertisement with your data included. I suspect an advertisement based on the page info is 90+% of the value.

That being said, they can't truly pay you meaningful amounts for your data and answer to their shareholders. That's why it's not really done yet.

Plus, they dont' need to in many cases. The whole internet is designed to collect all this data from you, without your consent being necessary.

<comment><USER11> > Today, I suspect the benefit of having said data is probably unknown. This > data is probably only valuable in aggregate to determine trends.

One of the biggest purchasers of this data is private bounty hunters. It's definitely useful to them, both in real time and "recent time".

[https://www.vice.com/en_us/article/43z3dn/hundreds-bounty- hu...](https://www.vice.com/en_us/article/43z3dn/hundreds-bounty-hunters-att- tmobile-sprint-customer-location-data-years)

</comment></comment></comment><comment><USER4> > giving the right to sue to customers who have had their location data shared > without their explicit permission.

Are Terms of Service considered explicit?

<comment><USER12> Hopefully not, nobody reads the TOS and it's really unreasonable to expect users to. For example, Twitter's TOS clocks in at around 5,000 words, who has time for that?

Between the apps for work and the apps I use for fun, it would take me weeks to fully read through all of the TOS for every piece of software I use if I was insane enough to do it.

<comment><USER13> "Nobody reads those" isn't a valid defense. That said, I see a huge problem in adding abusive clauses when you have a monopoly or duopoly in the area. The customer can refuse, but then what? Will they simply not have a phone or Internet?

<comment><USER14> > "Nobody reads those" isn't a valid defense.

Why not? Presumably the goal is that consumers understand the agreements they're in. If nobody reads ToS and everyone knows that nobody reads ToS, then they aren't useful communication.

</comment></comment></comment></comment><comment><USER15> Just ban all ad tech while you're at it. No one will miss it.

<comment><USER16> You will when you see the knock on effect to all consumer good pricing

<comment><USER17> Why would there be any significant added cost to consumer good pricing?

<comment><USER18> > _Why would there be any significant added cost to consumer good pricing?_

Assuming ad tech makes advertising more effective, banning it would make challenging a market incumbent more difficult. You'd need to burn more cash to teach more consumers about your product, a larger fraction of whom would be outside your target market.

Granted, ad tech does not always add value. And there is a legitimate question as to the trade-off between privacy and consumer prices. But the tradeoff exists. Reducing the threat of new entrants means incumbents will raise prices.

<comment><USER19> That assumes there is only one way to reach users, ie through internet wide surveillance. This is simply not true. You have a new wakeboard gadget, advertise it on a wakeboard forum or a wakeboard site. I _visit_ EETimes so I can see the ads.

An intermediary doesn't need to _know_ me so they can profit from selling my existence and desires to a 3rd party at the drop of a hat.

<comment><USER20> > That assumes there is only one way to reach users, ie through internet wide > surveillance. This is simply not true. You have a new wakeboard gadget, > advertise it on a wakeboard forum or a wakeboard site. I visit EETimes so I > can see the ads.

 _This_ assumes "ad tech" == "internet wide surveillance". That is certainly the most profitable subset, but it is still just a subset. _Something_ needs to serve those ads and make sure they are relevant to the content they are shown with, even if it exclusively uses the context of the specific page being loaded. Something needs to manage campaign tracking to know which specific sites or which specific ad copy is driving users in, even if no information about the users themselves is captured. Something needs to manage the connections between the ad copy and the site being advertised, both to ensure users go to the place they are supposed to and to combat malicious or hijacked ads.

All of this is "ad tech". Even if you think we should return exclusively to the days of random, untracked banner ads _some_ amount of ad tech is necessary.

<comment><USER19> I agree, and I don't think it is necessarily bad. But biz and marketing folks tasted milk and honey of the panopticon and they will fight kicking and screaming to keep it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Stories about bills that haven't passed yet are mostly fluff, because most bills never go anywhere. This is a story about a bill that hasn't even been introduced yet. That makes it an announcement of an announcement, the gold standard of offtopicness.

[https://hn.algolia.com/?query=%22announcement%20of%20an%20an...](https://hn.algolia.com/?query=%22announcement%20of%20an%20announcement%22&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0)

</comment><comment><USER22> How they get free pub for "considering" something. Consideration is for voters. Act or do not act. There is no consideration.

<comment><USER23> This is a meaningful tactic. Voters and cell providers alike are alerted this is coming down the pipeline. It is a way to gauge voter interest, ie how hard should the politician push for this particular regulation given the returns on support that can be anticipated from public engagement. It also puts the cell providers on notice and incentivizes them to compromise and cooperate to avoid more hostile regulation.

<comment><USER24> Seems like in practice this would incentivize providers to lobby the politician considering legislation..

</comment></comment></comment><comment><USER25> Stuff like this makes me glad to live in NYC, but it does kind of depress me that it has to come to an explicit _law_ , and moreover even more annoyed that it was ever legal to do that in the first place.

<comment><USER26> You're surprised it needs a law but wasn't illegal already? How could it be illegal without a law?

<comment><USER25> I said "explicit" law, since I would have hoped it was covered under previous law. Clearly I didn't word this correctly, so I apologize for any confusion.

</comment></comment></comment><comment><USER27> When I leave home I turn off all networking. I'll turn it on if I need it, but then turn it off again until I get to work. Same when heading home in the evening.

<comment><USER28> You will have to be in airplane mode (no cell reception) for this to be meaningful. Even then you probably turned it on enough times in the places you frequent for the data to be solid.

<comment><USER27> I do use airplane mode.

</comment></comment></comment><comment><USER29> Oh, they'd _consider_ not violating our fundamental privacy? How...'considerate'.

</comment><comment><USER30> Seeing is believing.

</comment><comment><USER31> Cities don't tend to propose shooting their golden goose in the foot so I hope this is a decently strong signal that the finance industry doesn't make all that much use of this data.

Edit: Why is this down-voted so heavily? Too cynical?</comment>


Aviation is stuck in the 60s – a reflection on MH 370 - <AUTHOR> http://english.martinvarsavsky.net/general/aviation-is-stuck-in-the-60s-a-reflection-on-mh-370.html <comment><USER2> Most modern airliners have satellite links (data and voice) with their dispatch centers. They also use the ACARS system to send and receive clearances (they can acknowledge by pushing a button). The old SELCAL+HF radio is no longer in use, except for backup.

Planes have GPS trackers. Not only their company knows where they are, the control center can too. In the case of the north atlantic track system, air control keeps a tight eye on speed, altitude and separation with very precise measurements, even as airplanes are far away from land.

I just fail to see the point of this post. I recently hitched a ride on the cockpit jump seat of a modern airplane for a Europe-East Coast flight and during that I saw the air traffic control knowing exactly where we were, and the pilots communicating via text message (ACARS) with control, as well as using satellite links to contact dispatch (via text messages), as well as satellite phone calls.

Pilots keep paper around them because pilots are there to maintain control, and paper is just another failsafe (with pretty good reliability record!).

Bonus: some planes can notice alterations in the flight dynamics and report an ice buildup. No pilot in this planet is going to let any external person input flight parameters remotely into their aircraft's system while they are in the air.

<comment><USER3> > I just fail to see the point of this post.

Haven't you read about the missing aircraft?

Malaysia Airlines Flight 370 is a missing international passenger flight operated by a Boeing 777-200ER aircraft: [http://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_370](http://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_370)

At least two of the passengers were travelling using false identities (stolen passports, tickets bought at the same time).

Edit: last known position: [http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d8...](http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d81a27)

<comment><USER4> Oh wow. If it's straight-up missing they could be anywhere in Asia right now... nuts.

<comment><USER5> Not likely. It was at cruising altitude and then vanished off the radar screen after sudden maneuvering. If it had diverted it would have continued to be tracked on radar. Even if they had shut off transponders and such, primary surveillance radar would have continued to see them. It almost certainly experienced a sudden catastrophic failure in flight (and I would bet due to a bomb).

<comment><USER6> Or not a bomb, just some maintenance problem. No group claims responsibility. The point of bombing seems to be to strike fear and send a message. The passport thing is curious but stolen/fake passports can be of use for other things that are nothing to do with terrorism.

<comment><USER5> Indeed. My money is on "bomb" just because it's hard to come up with a maintenance problem that causes such a rapid disaster at altitude. It would have to be something that caused a massive explosion like TWA 800. Possible, but unlikely. The lack of a claim makes a bombing less likely too, but IMO less so than the improbability of a mechanical problem.

<comment><USER7> Sudden explosive decompression?

<comment><USER8> Bingo, e.g. [http://en.wikipedia.org/wiki/China_Airlines_Flight_611](http://en.wikipedia.org/wiki/China_Airlines_Flight_611)

Or other examples that manage to disable enough of the flight controls but don't immediately break up the plane

<comment><USER5> As I understand it, you'd expect such a thing to happen during the climb. That's what happened with your linked flight 611, if I'm reading between the lines correctly, and it's what happened on e.g. Aloha 243. In general it would make sense that the failure would typically make itself known as the stress on the fuselage is increasing, not after it's reached a steady state. Not that it's _impossible_ , but the fact that this flight was at cruising altitude for a while before it disappeared would seem to be an argument against this possibility.

<comment><USER8> Also true for [http://en.wikipedia.org/wiki/Japan_Airlines_Flight_123](http://en.wikipedia.org/wiki/Japan_Airlines_Flight_123), the event happened "at near cruising altitude". Although I wouldn't say a plane once cruising is entirely steady state, there are winds and such. But, yeah, as you climb stress on the pressure vessel increases and that's when you'd expect a flaw to manifest.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It may be stuck in the 60's but HF radios _work_

sure you can create an automated dispatch system on an iPad. How do you authenticate it? how do you tell if its not working? does it fail safe? Making safe software is hard, and well beyond the wit of your standard programmer.

After all, can you gaurentee your software when the CPU is at 100%? can you say with certainty what happens when your CPU is hammered by all the interrupts at the same time?

Everything in the whole stack has to be verified. Thats means no virutalisation, no ruby, no perl, no python no ethernet. You can have firewire 400 though.

One can almost guarantee that this plane crash did not crash because of a failure in ATC<->Pilot communication.

<comment><USER10> At times like this, I'm reminded of the Mars Curiosity's tech specs which are something like 200MHz, 256MB of RAM, 2GB hd,and 2MP camera and all the posts about how my iPhone is so much better. Well it was good enough to get to Mars and a hell of a lot more reliable.

<comment><USER11> Some of the research rovers we built before Sojourner had 8-bit processors with 2k EEPROM and 256 bytes of RAM. Back then there were people who thought we were crazy for thinking that some day we would be able to fly with the same 8MB of RAM that was in our MacII development machines.

</comment></comment></comment><comment><USER12> Most modern aircraft have GPS receivers built-in. They are actually constantly reporting this information to ground stations [1].

I'm not saying that things couldn't be better (and I'm no expert at all) but I doubt that any of these new technologies would have saved MH370.

It's very weird, for instance, that the ground station that reports to flightracker24 lost ADS-B communication with the plane all of a sudden and it's pretty clear from the number of planes that you can see in the area that it is probably not a coverage issue.

[1]: [http://en.wikipedia.org/wiki/Transponder_(aviation)](http://en.wikipedia.org/wiki/Transponder_\(aviation\))

<comment><USER3> Is a Boeing 777-200ER (introduced 1997) a modern aircraft in your opinion?

It seems that Flight 370 had GPS tracking (flightradar24.com screenshot): [http://www.voanews.com/content/vietnam-navy-official- missing...](http://www.voanews.com/content/vietnam-navy-official-missing- malaysia-airliner-crashed-into-south-china-sea/1867053.html)

Direct link: [http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d8...](http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d81a27)

</comment></comment><comment><USER13> So having internet would somehow magically solve all the problems. Also it doesn't seem to be written out clearly, but there seems to be the implied assumption that Air France Flight 447 had no GPS tracker. Which is false. It did have, and automatically reported it's position at certain intervals.

<comment><USER14> Good point. On-board internet works great when the aircraft is at level and stable flight. It's a lot harder to transmit to a satellite in the middle of the ocean when the plane is gyrating and tossing all over the place (as in the case of AF447).

All bets are also off when the plane has had a catastrophic loss of power.

</comment></comment><comment><USER15> Hopefully the author is reading this, as I have some structural comments.

First, I agree with your thesis. In fact, I'd argue General Aviation is stuck in the 1950s. Lots of reasons for that, including the cost of insurance.

Second, I had a hard time reading this, as you seem to lack the ability to form cohesive paragraphs. Very sorry to have to tell you, but I figured somebody should. Nobody can read a big wall of text where each paragraph is trying to say several different things at the same time.

Best of luck in future drafts.

</comment><comment><USER16> I am by no means an aviation expert, but my career was largely built on things like putting GPS and modern radios into military aircraft, writing flight planners, and so on.

I ask you to envision the logistics of a simple change. You want to implement X, and gee-whiz do I have some cool, new technology that makes it easy!!

Okay. Let's start. If we make mistakes people die, and careers end. I'll let you draw your own conclusions about motivations re that, but all I'll say is as an engineer I only ever focused on the former. So, huge testing and verification effort to show that my gee-whiz technology that works in some consumer device has acceptably low failure modes, does not negatively affect pilot work flow, can work under the conditions of flight (-55C to 70C anyone?), over the wide performance characteristics (high G, high vibration, salt water, high radiation), and so on.

Okay, you did all that! Let's start bolting it on the planes!

No.

Let's write and get approved training programs for all the maintenance workers. Then, let's train them - across the whole world. Let's write and get approved training programs for the pilot. We will fit it into their refresher training, have new mandated training, or what? Basically, rewrite all the training curriculum that is out there. Get it into the schools, so the pilots coming fresh out of school aren't behind. Again, across the world.

Oh, this interfaces with the towers? Okay, so do all that again with the towers. Hmm, you want this 2013 technology to seamlessly integrate with some core memory technology - that should be easy. Perform a study, put out RFQs, get bids, select the best bidder, have them build the system, manage them through the cost overrun, opps, 3 months before deployment Congress mandates that that core-memory system be retired, and oh, how will this work in the 168 other countries?

Got that sorted. No, wait, no one in the tower knows how to use it, no one knows how to install it, no one knows how to maintain it. Let's throw money and time at that! Oh, unions. I hate unions. ATCs have a union. This could take awhile....

Finally, it is 2020, and I am rolling out, um, 7 year old technology that is entirely obsolete and no longer supported by the manufacturers. Oh, they'll support it if you throw enough money at it - get your $5 microprocessor at $1000 a pop.

Meanwhile, the entire world is _filled_ with aircraft still using the old system. So, we mandate a phase-out by 2035. Just another 15 years of supporting the old and new systems in parallel. I'm sure that'll be pretty cheap.

People who work in the field will rightly accuse me of hand waving, and especially of over-exaggerating some difficulties (not every modernization project hits every possible snag that exists). But this is still a useful sketch the scope of the problem. I've spent time talking to very high people in the FAA. They are not unaware of the old systems and their limitations, nor are they bumbling bureaucrats (pet peeve - it is easy to villanize faceless people, and that is very lazy thinking). We in industry are forever proposing new ideas, better technology, and so on (let's face it, they are all trying to feed at the trough of government spending, and getting your system mandated is a company maker). But the price tag for my handy,dandy system is at the noise level compared to the cost of the logistics of deployment.

I am not arguing that there is nothing to be done, or that everyone is working maximally efficiently right now. Certainly the US is behind other countries in some areas of aviation technology. But it is not in any way a trivial problem, one of "just bolt a new radio to the plane and trash the old ecosystem".

edit: consider, for example, the Rockwell Collins DTU-7000 Data Transfer Module ([https://www.rockwellcollins.com/sitecore/content/Data/Produc...](https://www.rockwellcollins.com/sitecore/content/Data/Products/Computing/Storage_Solutions/DTU-7000_Data_Transfer_Unit.aspx)). This is absolutely modern hardware in the aviation world. It is PCMCIA. And how exciting it was to get. You would not believe the cost and size of the old system - we would jealously keep tracking logs of, I forget, a few MB of flash memory units that cost thousands and thousands (and thousands) of dollars. There is some even more modern stuff being rolled out that uses usb. But consider, when this is something that contains your flight plan, your maps, and so on, the cost of a stray gamma ray blowing away a byte. Mull on how much testing this hardware goes through. And then factor in all of the logistics above. We already don't have money to own the old system, and now I have to go to all this further expense, to save what is truly chump change (that thousands and thousands and thousands number) in the end? Millions to save thousands.

Of course, we have to modernize, we can't store rich maps on tiny memory, so we spend, and spend, and spend. And then get a front page HN story about how old everything is! Well, there's a reason for that.

<comment><USER17> If bureaucracy prevents new technology of being adopted quickly, then that bureaucracy actually decreases safety, even if it's goal is to increase safety. Yes, adopting new technology increases some risks, but also decreases others. The good thing is that usually you can have both systems on at the same time. If the internet connection and GPS fails, it's not difficult to fall back to the existing technology.

<comment><USER9> Well no.

What happens when the GPS says one thing, and the "internet" says another?

what takes precedence?

The "Internet" isn't safe, reliable or even bullet proof.

New technology isn't a golden bullet. Often its just a re-invention of the wheel. (whatsapp for example, is just MMS without the guaranteed delivery.)

I don't want my plane being crammed full of shiny new tech, especially if its not proven. Th reason why there is bureaucracy is to make things safe.

<comment><USER17> Well, you're just attacking a strawmen. "Proven" is not a binary value, there are degrees of proof when we're talking about aviation technology. One can reduce bureaucracy while still leaving a justified amount of bureaucracy.

As for preference, it's already norm that there's a multiple different input sensors, and the autopilot and the real pilot has to deduce the correct value. (Good example is air speed, see Air France Flight 447).

</comment></comment></comment></comment><comment><USER18> "Imagine if you had a telephone system in which you had to listen to everyone else's conversations until somebody finally spoke to you."

Now imagine that everybody on the alternative secret phone system is flying around hundreds of passengers who'll be killed if somebody misdirects a call with important instructions.

I've found that, in general, if one's reaction to a practice is "WTF, is literally everybody else in this industry stoopid?" it usually means the opposite...

</comment><comment><USER3> Can an aviation expert decipher the following data?

      MH370/MAS370
      Boing 777-2H6ER
      Registration 9M-MRO
      Altitude 0ft
      Speed 471 kt
      Track 40°
      Vertical Speed 0 fpm
      Lattitude: 6.97
      Longitude: 103.63
      Radar: F-WMKC1
      Squawk: 2157

source: [http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d8...](http://www.flightradar24.com/2014-03-07/16:46/12x/MAS370/2d81a27#./2d81a27?&_suid=139439012725505032063548222576)

That particular airplane was delivered new to Malaysia Airlines in May 2002 and was involved in a ground mishap in 2012. While taxiing at Shanghai's Pudong airport, its wingtip hit the tail of another aircraft. According to an independent accident-tracking site, the damage suffered by the Boeing 777 was "substantial.": [http://aviation- safety.net/wikibase/wiki.php?id=147571](http://aviation- safety.net/wikibase/wiki.php?id=147571)

<comment><USER19> Probably an incomplete or corrupt report. It would be an incredible coincidence of timing for the system to produce a location data point precisely at the moment that the aircraft hit the water and before the system was destroyed. This is probably an incomplete report when aircraft left the coverage area or if the system malfunctioned mid-air and mid-transmission.

</comment></comment><comment><USER20> The last thing I want to see is internet in the cockpit. What _hasn 't_ been hacked over the last few years?

</comment><comment><USER21> Does weather change that drastically over the duration of an average flight?

Pilots get weather forecasts before take-off, are they inadequate? How does knowing the weather at the destination help with the immediate task of flying a plane through a thunderstorm that you knew was going to be there anyway and you can see on your radar?

How more weather information change the impact of a major weather event e.g. East Coast winter storm, on air travel? I don't see how it could, the decisions are made far ahead of time because weather forecasts are pretty good.

</comment><comment><USER22> The only modernization needed is elimination of human pilot all together out of the loop. Then there is no training, union, or endless testing, as the robot is fail safe just like there have always been more than one engine in commercial airplane.

Purposefully staying behind the technology curve is not a "safe" strategy, aviation is not alone in this obsolete thinking bias, the same is seen in utility, automobile industry too.

</comment><comment><USER23> I don't know much about aviation, but a number of these technologies are being implemented in commercial flights now, including NextGen ([http://en.wikipedia.org/wiki/Next_Generation_Air_Transportat...](http://en.wikipedia.org/wiki/Next_Generation_Air_Transportation_System)).

</comment><comment><USER24> I'm sure I saw a documentary a few years back where an aeroplane engine manufacturer had a control centre. The sole purpose of this place was to track minute engine attributes in real time, and alert their clients of future maintenance. Is that just on the latest planes?

<comment><USER25> A lot of airlines hire the engines by the (flight-) hour, and those engines are monitored in real time by the manufacturer. For example:

[http://www.telegraph.co.uk/travel/travelnews/8111075/Live- mo...](http://www.telegraph.co.uk/travel/travelnews/8111075/Live-monitoring- helps-engine-manufacturers-track-performance.html)

</comment></comment><comment><USER26> Every commercial airplane has a GPS tracker and a transmitter which sends its vital info on air, which everyone can receive and track on sites like [http://www.flightradar24.com/](http://www.flightradar24.com/) .

</comment><comment><USER27> Interesting ideas. Just a quick note about the layout of the blog text: font and line spacing are too small and the text column is too wide. The combination makes it a little hard to read. Plus points on not having grey text on grey background though.

</comment><comment><USER28> Aviation is stuck in the 60s because if it wasn't airliner stuff would all be automatic.

<comment><USER29> @spiritplumber, I can only assume you've never flown a plane or used a flight simulator (MS Flight will do).

Today's airliners are incredibly advanced. In the 60's they didn't have Terrain Collision Avoidance. Try to fly the plane into a hill and alarms go off and tell you how rapidly to ascent. They didn't have automated traffic collision avoidance (TCAS). Fly two planes at each other and it tells one pilot to dive, the other to climb and how much. They didn't have stick shakers which alert the pilot if the plane is near stalling, before it stalls, so they know to gain air speed to prevent the stall.

Those are the basic standards. Today any aircraft worth it's salt has a full Doppler weather radar to avoid storms, hail and down drafts. Today the entire flight path is computer calculated and tracked from end to end. Just turn on auto pilot or keep the indicators aligned on your artificial horizon and you'll get where you're going. No one gets lost these days without trying. I've not going to even start on CatII and CatIII landings too. Today planes can land in 0, that right 0, visibility.

> if it wasn't airliner stuff would all be automatic

But let's keep going. Ever heard of AutoLand? Yep, plane can land itself. Ever heard of AutoFlare? Yep, plane will tilt back at just the right angle for a pillow soft touch down. Ever heard of AutoThrottle? No need to keep adjusting those engines, plane takes care of that, just tell it where you want to go. Frankly, pilots rarely do much more than tell the plane what it should do. Want to go to flight level 380? Just turn the knob to 38000ft, set the desired vertical speed rate and the plane will adjust the throttles, ailerons and trim itself out at 38000ft for you. Want to go to heading 245? Just dial in 245 degrees the plane will take your speed into consideration and speed up just enough to keep everything constant through the curve.

Funny thing about automation though is not getting everything automated, but keeping pilots from getting stale because too much is automated. Take the Asiana flight, it's what we call Controlled Flight into Terrain. Not a thing wrong with that 777 but the pilot.

We're worlds away from the 1960's and the 777 is among the most sophisticated and advanced craft in the world. Far more advanced than even our spacecraft of the 1960's.

<comment><USER30> Autoland is 60s tech [http://en.wikipedia.org/wiki/Autoland](http://en.wikipedia.org/wiki/Autoland).

But TCAS and GPS-aware Enhanced Ground Proximity Warning System (EGPWS) are 90s, and automation vs maintaining flying skill is definitely a major challenge.

<comment><USER29> Indeed Autoland started deployment in the 60's, though not in a pervasive sense until decades later. Point on that was that we've had a lot of automation for in aircraft for some time. :)

</comment></comment></comment></comment><comment><USER31> I cannot believe I am doing this, but .... how about a few paragraph breaks once in a while?

</comment><comment><USER32> The moment we saw bunch of aviation articles on HN and that plane disappears. Coincident?

</comment><comment><USER32> The moment we saw bunch of aviation articles on HN and that plane disappears. Coincidence?</comment>


The Secret Life of Time - <AUTHOR> http://www.newyorker.com/magazine/2016/12/19/the-secret-life-of-time <comment><USER2> It might be interesting to consider how and whether time is relevant to computation. For example-- does time have an arrow on a computer?

It does, for at least two reasons: 1) Computation physically produces heat and increases entropy. 2) Many operations lose information -- for example XOR's can't be run backwards to reproduce the original inputs.

People have tried to tackle both issues with reversible computing. [https://en.wikipedia.org/wiki/Reversible_computing](https://en.wikipedia.org/wiki/Reversible_computing)

Someone even wrote a programming language that was (logically) time- reversible:

[https://en.wikipedia.org/wiki/Janus_(time- reversible_computi...](https://en.wikipedia.org/wiki/Janus_\(time- reversible_computing_programming_language\))

<comment><USER3> Does having a time-reversible programming language mean that if you start with the output of a given program, you can run the program backwards and get the input?

This would be useful outside of research. Though, I expect the memory usage will be ridiculous.

<comment><USER4> Isn't that already a thing, if you really want it? [1,2,3]

[1] [https://en.wikipedia.org/wiki/Retroactive_data_structures](https://en.wikipedia.org/wiki/Retroactive_data_structures)

[2] [https://www.youtube.com/watch?v=T0yzrZL1py0](https://www.youtube.com/watch?v=T0yzrZL1py0)

[3] [https://www.youtube.com/watch?v=WqCWghETNDc](https://www.youtube.com/watch?v=WqCWghETNDc)

</comment></comment></comment><comment><USER5> Still working through the article, but it reminded me of the presumable fact that everything that happened before the first conscious entity existed in the Universe was essentially instantaneous. Same goes for time's forward direction. Without consciousness, i.e. with a perfect form of stasis, one could time travel to just before the heat death of the Universe in an instant.

John Archibald Wheeler took this idea even further with the PAP, the Participatory Anthropic Principle.

<comment><USER6> You are asserting that "the Universe" can exist without a "conscious entity".

<comment><USER7> A Whale, of course.

<comment><USER6> Or a potted plant.

</comment></comment></comment></comment><comment><USER8> The passage of time is an emergent property of quantum entanglement. Yes, I know that sounds like new-age hooey, but it's actually based on solid science:

[http://blog.rongarret.info/2014/10/parallel-universes-and- ar...](http://blog.rongarret.info/2014/10/parallel-universes-and-arrow-of- time.html)

[UPDATE] I would really appreciate if those of you who are downvoting this comment would tell me why.

</comment><comment><USER9> "Where is it, this present? It has melted in our grasp, fled ere we could touch it, gone in the instant of becoming."

It might be a stretch, but this seems like a small glimpse of the concept of a time differential ('dt'), a thousand years before the math existed to describe it explicitly.

<comment><USER10> Most ideas don't have explicit mathematical descriptions. Why would this one be more notable than any other?

</comment></comment><comment><USER11> Fascinating article. Great, long read.</comment>


Hudl Scores $72.5M from Accel to Rally Teams to Its Sports Video Coaching Tool - <AUTHOR> http://techcrunch.com/2015/04/02/hudl-sports-video/

<comment><AUTHOR> Great story out of the Midwest for a usually quiet company in the tech press -

> "Hudl charges around $1,400 a year per high school and college team. That > allowed it to build software-as-a-service business that won $30 million in > revenue in 2014."

\- Founded in 2006 \- Funding to date: $3m \- 290 employees across four offices \- David Graff, co-founder, has been CEO since start \- Besides nearly every high school football team in the US, customers include NFL team, NBA teams, and 13 of 20 Premier League football clubs</comment>


Apple says Australia's banks pose a security threat to iPhones - <AUTHOR> http://www.afr.com/technology/apple-says-australias-banks-pose-a-security-threat-to-iphones-20160809-gqogpr <comment><USER2> Some context: Australia is different because they regulate interchange fees. Credit card interchange averages 0.5% / max 0.8% [1] whereas in the U.S. it's in the range of 1.4-2.4% + 5-10 cents.[2] So that's part of the reason banks are more aggressive with their negotiation. There's less of a pie to slice up.

Some more context.. This is a game with 3 main actors: banks, merchants and consumers. Apple's strategy was a smart one vis-a-vis Bitcoin and other "low fee" efforts. While many payment startups have attempted to woo merchants to adopt them with the promise of a lower-fee system, Apple focused on wooing consumers and banks by fully supporting the current, higher-fee interchange system. Banks get their higher fees and consumers get their rewards. Merchants get some security benefits (not as vulnerable to data breaches), but they mainly face pressure from consumers to support it as an amenity. That's much more successful than something that's price-friendly to merchants but offers little advantage to consumers or banks.

Problem is in Australia, thanks to regulation there is no "high fee" system to shore up for banks. So they are not as amenable to Apple Pay as in other countries. They want their own system in place so they can get the full 0.5% and, moreover, look for other ways to make money with it.

[1] [http://www.rba.gov.au/payments-and-infrastructure/review- of-...](http://www.rba.gov.au/payments-and-infrastructure/review-of-card- payments-regulation/q-and-a/card-payments-regulation-qa-conclusions- paper.html)

[2] [https://usa.visa.com/dam/VCOM/download/merchants/Visa-USA- In...](https://usa.visa.com/dam/VCOM/download/merchants/Visa-USA-Interchange- Reimbursement-Fees-2015-April-18.pdf)

<comment><USER3> FWIW, the EU also caps interchange fees (0.3% for credit cards and to 0.2% for debit cards) but that doesn't seem to have stopped Apple Pay adoption in the UK.

<comment><USER2> That's a very good point. Some possible explanations (let me know what you think):

1) Banks have healthier competition in the EU? They wouldn't be able to form a cartel like they are trying in Australia.

2) Fraud liability is fully borne by the consumer in Europe, whereas Australian banks still have to refund customers?

3) It's a very new change (December), whereas Australian banks have lived with it for a decade or so.

Personally I think #1 is sufficient to explain it.

</comment></comment></comment><comment><USER4> > These banks want to maintain complete control over their customers.

And Apple want to maintain complete control over _their_ customers. No-one has clean hands in this.

I trust that Apple's cage has much nicer gilding than the banks', but I'd rather not live in a cage at all, thank you very much.

<comment><USER5> That's a false equivalency. Apple being a closed platform is not an excuse to allow the banks to form a cartel.

If you don't like Apple, you can use Android. But if every bank in Australia decides what you can and can't do with your phone when making payments, where will you go?

<comment><USER6> It's even worse. If Apple gets their way, ApplePay will be available to Apple users only. If banks get their way, their payment system will be available to everybody. It's quite clear to me which one is better...

<comment><USER7> Apple Pay doesn't stop other payment provisions from functioning. The same contactless reader will read Apple Pay, Contactless cards, and Android Pay.

Of course Apple Pay will only be available to Apple users. That's literally what Apple Pay is: contactless payment on an Apple device. There's no reason for there to be Apple Pay on Android or another platform.

<comment><USER8> Which still means I'm not allowed to pay for anything on an Apple device (since Apple hasn't and probably won't make it available locally), while an application built by my bank would.

<comment><USER9> I've worked for banks. I'd trust Apple to build a secure environment but not a bank.

<comment><USER8> Which kinda misses my point. A "secure" Apple service only available in select few countries with no ability to compete or implement your own is more useless than theorycrafting your experiences from banks to other world banks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> As an American living in Australia, you quickly see the lack of innovation on payments in the US. Contact-less payments have been prevalent since moving here in 2012. The ability to pay bills via a common protocol is so nice, BPAY. The ability to move money between people electronically without third parties is also refreshing, direct bank transfers.

I have a Nexus 5 and use NFC payments via Google Pay and Bank Apps. In my opinion, they both are terrible from ease of use standpoint. Tapping my card on the terminal is far superior to opening an app and fumbling with it. As far as Apple is concerned, I think they are completely in the wrong in not letting other apps use NFC. Ideally, they win market share by creating the better experience. The banks getting together to negotiate terms is ridiculous too. In my opinion, an ideal outcome would be open NFC use on Apple devices. The better experience wins. I do not think collectively negotiating terms does anything for the consumer.

<comment><USER11> > _Ideally, they win market share by creating the better experience._

Right now Apple can't provide the better experience, because the banks in question will not support their system. The banks don't want to support Apple Pay, so Apple opening up NFC would just shift the balance of power entirely in favor of the banks.

<comment><USER12> My impression is that the banks want the access to be bidirectional. If they give access to Apple Pay, Apple should give them access to the NFC module.

That seems fair to me. Apple should have to compete instead of monopolising its platform.

<comment><USER13> No. That's not what the banks want. The banks want to form a cartel to collectively negotiate with Apple, which effectively means no negotiation at all. They want to strongarm Apple to open up its NFC module to individual banking apps; they won't roll up Apple Pay.

<comment><USER12> I don't buy it. Apple is just painful to negotiate with and the banks want an at least semi-even table to play at.

This conflict isn't unbalanced. The same access is being sought on both sides. The banks want their ~10M ish iPhone users to have access to payments on their phones. Apple wants the same ~10M ish users to have access to payments on their phones. Both sides want something of equal value, it simply seems like Apple wants it all and isn't willing to give anything up.

<comment><USER13> The big 4 want to boycott Apple Pay, and want to strong arm others into boycotting Apple Pay too. They want a mafia ruling, not amicable solution.

This is the submission:- [http://registers.accc.gov.au/content/index.phtml/itemId/1197...](http://registers.accc.gov.au/content/index.phtml/itemId/1197444/fromItemId/278039/display/application)

<comment><USER12> Thank you, that actually backs up what I've been saying:

> competition: the applicants wish to ensure that the potential for > competition and innovation in the emerging market for mobile payments is > maintained. Therefore, they wish to collectively negotiate in response to > any technological or other exclusivity that a Third Party Wallet Provider > may seek to impose by:

> \- refusing, restricting or failing to provide software access to any > payment functionality built into devices manufactured by or for, or > operating systems developed or distributed by, the Third Party Wallet > Provider, for example NFC functionality; and/or

> \- otherwise preventing or impeding card issuers from developing, deploying > or participating in any other mobile payment or mobile wallet services or > Third Party Wallets on any mobile devices or platforms;

They're mainly concerned with fraud standards and making sure nobody (Apple) tries to limit access to their platform.

As for your boycotting and "strong arm" claims, this document shows that scope is significantly narrower than you're implying:

> Accordingly, the applicants seek authorisation to: [...]

> enter into a limited form of collective boycott where the applicants will > agree not to negotiate with the relevant Third Party Wallet Provider on an > individual basis while collective negotiations with that Third Party Wallet > Provider are ongoing.

The "boycott" in this document is referring solely to individual negotiation. i.e. Bank1 can't go behind the other banks' back and sweeten the deal while they're negotiating as a group.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> An important thing to realise about the Australian banking market is that we're already a world leader in the adoption of contactless payments using our credit cards. (And unlike the US, our floor limit is $100, which covers almost all transactions. When exceeded, most terminals just prompt for your PIN.)

I'm sure Apple Pay is great, but with an entire continent already familiar with tapping their credit card, tapping a phone doesn't seem like much of an improvement.

<comment><USER15> I'm Australian but I live in the US now. I go back fairly often. Last year I tried out PayPass for the first time.

Contactless payments as implemented in Australia is (IMHO) a disaster. Here are the problems:

\- No opt out. You couldn't get an ATM card without it. This led to various guides on drilling a hole in the RF antenna to disable it. Last I heard the ACCC was intervening to force the big banks to give consumers an opt out. Not sure if this has happened yet.

\- Report your card stolen and the thief can still keep using PayPass. Why is this even possible in the modern age of the Internet?

\- The burden of proof on unauthorized transactions is on the consumer. I seem to recall reading something from the T&Cs that claimed you could be charged a fee for a "false" (ie denied) claim and you could only claim unauthorized transactions once or twice a year.

\- In the case of disputed transactions the merchant is on the hook for it leading some to not accept it.

Basically contactless payments in Australia are an effort by the big banks to not be responsible for fraud. There's no real benefit to consumers.

<comment><USER16> > The burden of proof on unauthorized transactions is on the consumer.

The burden of proof for unauthorised transactions is _never_ on the consumer.

> In the case of disputed transactions the merchant is on the hook

It is always the merchant who's on the hook for disputed transactions. The banks/issuer is _never_ on the hook.

Contactless payment is literally just a more convenient version of magnetic/chip payment, with everything else being the same.

<comment><USER17> > The burden of proof for unauthorised transactions is _never_ on the > consumer.

It's true that the merchant has to prove that the consumer made the purchase. However, the burden is still on the consumer, since they still have to service the transaction until the dispute process is resolved.

</comment></comment></comment></comment><comment><USER18> Apple couldn't really be more disingenuous here. This has nothing to do with user security and everything to do with squelching competition. Competition _for_ them, not for the banks. The banks just want to compete and Apple doesn't want to let them.

This is exactly why I do not own an iPhone.

<comment><USER14> Unless you know what the banks specifically want changed in the deal, you can't substantiate that assertion. Apple has undoubtedly put a lot of time and money into validating and auditing the security around Apple Pay. It's a solution that doesn't need to be modified for the Australian market: one major Aussie bank has fully adopted Apple Pay already.

There's no way Apple are going to allow that effort to be trashed by a few banks in a small overseas market. (It's also highly probable that the banks want to be able to implement processes that bypass the consumer friendly aspects of Apple Pay, like its strong privacy controls.)

<comment><USER19> > small overseas market

That depends really. While Australia is a relatively small market, _everyone_ here pays using paywave (contactless payments via credit/debit cards, 69% owned and 43% used in 2013!), and if a shop has a card terminal they support it. If it could be enabled on iPhones, they would get instant adoption by lots of people.

I can't see any specific numbers to compare right now, but I'd be interested to see some contactless payment comparison between the US and Oz for 2015.

<comment><USER20> Why do you think people would use their iPhones over the cards they already use, though? That's going backwards in terms of efficiency for the user, and it's not like the majority of people care about security.

<comment><USER21> We already have our phone in our hands.

The efficiency of Apple Pay with a phone already in your hand over cards in a wallet in your pocket is night and day.

<comment><USER20> > We already have our phones in our hands.

Huh? Phone in hand while scanning stuff at the self-serve checkout? The only time I can think of myself using the phone while buying something is maybe at a convenience store while I'm _on_ the phone, which is definitely not handy.. "Just hold on for a sec mate, I'm about to tap you.."

> night and day

Nah. NFC vs magnetic was night and day. One form of swipe over another, no way. Especially not if I need to fiddle with a fingerprint scan or a non- tactile interface.

</comment></comment></comment></comment></comment></comment><comment><USER22> I'm an Aussie and use one of the big bank's apps on a s6 edge (the edge is weird and I hate it). Contactless payment already works great in exactly the way that a credit card does as a store terminal. Anyone know if Samsung gets a cut?

<comment><USER23> Not sure which bank you are with but mine seems to have some exclusivity deal with samsung phones which it hides under the guise of 'other phones are not secure enough to do contactless payments'. Not a hard fact but it would also lead me to believe they get some sort of kick back.

<comment><USER19> Samsung phones have a secure element, which means your NFC transactions happen a bit outside of the normal app's control. There's some extra information here: [http://www.sequent.com/secure-elements-vs-cloud-based-hce- se...](http://www.sequent.com/secure-elements-vs-cloud-based-hce-secure-nfc- mobile-payments/)

It's true that they provide security, but then again, other banks are happy to use other techniques (commbank's app does nfc payments on pretty much anything with NFC - nexus 5 included)

</comment></comment></comment><comment><USER24> Why would user security be compromised by NFC access any more than WiFi access or Bluetooth access? Or does Apple not provide APIs at the same abstraction level for WiFi/Bluetooth that the banks are requesting for NFC?

<comment><USER25> Apple does not provide developers with access to the NFC hardware and they also do not provide direct access to Bluetooth either. Using these is limited to being able to make use of IOS services which make use of these hardware capabilities such as Apple Pay, Bluetooth audio outputs, etc...

<comment><USER26> This is true of NFC but Bluetooth capabilities are much more open. I've personally used Core Bluetooth to connect and communicate with arbitrary devices and communicate over custom protocols.

<comment><USER25> I was trying a little to hard to be succinct, I've also used CoreBluetooth, I was lumping it into an awfully generic group by categorising that as part of the "services" provided by iOS, but I was thinking from the point of view that all the things the iOS frameworks provide are the ones Apple has _allowed_ them to provide on iOS. Effectively the framework is a way to access the limited set of allowed services, as opposed to direct hardware access. Otherwise we could do much more interesting things with Bluetooth such as implement new Bluetooth profiles and create things like apps where the iPhone functioned as a Bluetooth keyboard for another device.

<comment><USER27> This iOS app appears to be able to advertise custom bluetooth profiles, though? [https://itunes.apple.com/us/app/lightblue-explorer- bluetooth...](https://itunes.apple.com/us/app/lightblue-explorer- bluetooth/id557428110?mt=8)

</comment></comment></comment></comment></comment><comment><USER28> It's worth noting that Android Pay has launched with 28 banks in Australia.

[http://www.news.com.au/technology/google-launches-android- pa...](http://www.news.com.au/technology/google-launches-android-pay-in- australia-with-more-banks-than-apple-or-samsung/news- story/b717e8bc8cd651998920c34ffc1b926d)

It's also worth noting that Australia has 4 big banks that have over 80% of the Australian market. With 28 the proportion of the market covered is even higher.

Google were clearly prepared to make deals that Apple are not.

</comment><comment><USER29> > Providing simple access to the NFC antenna by banking applications would > fundamentally diminish the high level of security Apple aims to have __on > our devices. __

This is what I hate about Apple. I am fairly certain that the customers bought these devices -- so isn 't it their customers' devices?

Apple wants to sell iPhones, yet keep complete control over it. Simple things such as disabling updates is not possible -- because it is not in Apple's interest.

They completely redefine what ownership means -- you "own" it, but Apple "controls" it.

<comment><USER30> > Simple things such as disabling updates is not possible -- because it is not > in Apple's interest.

That seems disingenuous. Yes there is no explicit switch that prevents the user being informed about updates ever again, but there are no forced updates that I'm aware of. If you don't want to update, don't.

<comment><USER29> It is not possible to block downloads of updates or to switch of daily update reminders on new iOS devices. This is a well known problem: [http://osxdaily.com/2016/01/04/stop-ios-software-update- noti...](http://osxdaily.com/2016/01/04/stop-ios-software-update- notification/)

The only option is to avoid Wifi or configure your wifi router to block Apple.

</comment></comment></comment><comment><USER31> I think banking is a logical sector for tech firms to move into. Apple, Google, Amazon. They build platforms, and they enhance those platforms with services that they charge for.

Day to day banking is the sort of service that would really enhance their platforms, and would also have a massive side benefit of cutting out a notoriously difficult middle man that no one really likes anyway.

Take Apple as a thought experiment. The banks have already seeded Apple's hypothetical bank will all of their customers via Apple pay. Here in the UK, I can change bank account at the push of a button and everything is taken care of for me in just a couple of days. That's the law and there's nothing the banks can do to stop me. If Apple one day gave me a "Would you like to move your bank account to Apple" button, I'd press it in a flash, and feel a great sense of pleasure as I stuck it to the established British banks. With Apple's huge stock piles of cash, I think a takeover of an existing bank would not be unfeasible.

In addition, should tech firms start setting up or buying existing banks, there's plenty of legislation in place to ensure they play fair with each other.

It's pie in the sky thinking, but interesting to think about none the less.

<comment><USER32> Interesting idea. I'm curious what the regulatory landscape is like. Is it feasible to run a bank off of a giant multinational tech company?

I remember back in the day Apple needed to charge for iPod Touch software updates for some sort of accounting purpose.

<comment><USER31> I wasnt suggesting they offer those services for free. If they were to consider this, I imagine buying an existing bank would be the first thing they would look at. There are a number of banks out there that very few people have heared of. It wouldn't have to be a Barclays or a HSBC, just someone with a banking license or the opportunity to acquire one in the relevant territories. Also, the Financial Conduct Authority here has a strong appetite for being progressive and trying out new ideas. Other countries also take a lead from what the FCA says is OK or not.

</comment></comment></comment><comment><USER33> Confounding security and business policies is setting a bad precedent for the security of anyone that isn't able to throw their weight around in negotiations as well as Apple can.

<comment><USER34> They aren't.</comment></comment>


XSS Attacks: The Next Wave - <AUTHOR> https://snyk.io/blog/xss-attacks-the-next-wave/ <comment><USER2> I do not believe any entity in the world has statistics strong enough to make predictions like the expected percentage change in XSS year over year. Everyone claiming to have those statistics has thoroughly confounded their analyses by relying heavily on applications that have been made available to specific tools and companies. But the modal web application deployed on the Internet is the one that has had no security testing whatsoever.

Be very suspicious of articles like these.

</comment><comment><USER3> > Lastly, "DOM-based XSS" attacks occur purely in the browser when client-side > JavaScript echoes back a portion of the URL onto the page.

This Google Doc has tracked almost all "sinks" and "sources" for DOM-based XSS[1]. They aren't by any means limited to the URL (usually accessed by the `document.location` object).

[1] [https://docs.google.com/spreadsheets/d/1Mnuqkbs9L-s3QpQtUrOk...](https://docs.google.com/spreadsheets/d/1Mnuqkbs9L-s3QpQtUrOkPx6t5dR3QyQo24kCVYQy7YY/edit#gid=0)

<comment><USER4> You're right, I tried to keep this section as brief as I could. DOM Based XSS could happen from any source, but the hardest-to-detect (and very common) variant is using the fragment (the part after the #) to inject the payload, which is never sent to the user.

</comment></comment><comment><USER5> Why can't we tackle XSS in the browser, by preventing javascript from executing in the <body> (or anywhere other than <head> for that matter)? There is an old memory protection technique of designating the stack & heap (data portions of memory) as non-executable. It seems like a similar idea should apply to the web, where the DOM is effectively a "data" portion, and separate out all executable javascript into a separate section. I know this breaks things like `onclick=` attributes, but can't those be replaced with event listeners? Of course it would be opt-in by setting an attribute somewhere in the DOM (e.g. <body non-executable="true">)

This seems like a fairly obvious idea to me, but I'm not a frontend developer, so I'm looking for someone to tell me why this doesn't already exist :)

<comment><USER6> This already exists. It's called Content Security Policy. [https://developer.mozilla.org/en- US/docs/Web/HTTP/CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)

<comment><USER7> And it is an almighty pain in the arse to set up

<comment><USER8> Unless you can influence an organisation at a pretty high level it is often impossible to write a useful CSP.

To take a really degenerate example, media sites tend to have so many third- party JS integrations (maps, multiple analytics providers, ad systems etc etc) that you can't write a useful, security-improving CSP :/

Which means talking to marketing about their preferred analytics tool, asking the business if they _really_ want these ad networks etc etc.

</comment></comment></comment></comment><comment><USER9> "Single Page Apps increase the amount of client side logic and user input processing. This makes them more likely to be vulnerable to DOM-based XSS, which, as previously mentioned, is very difficult for website owners to detect."

Hmmm...assuming your back end has all the requisite validation and other security in place, how can a SPA cause an XSS? Are there any purely client side attack vectors (XSS or otherwise) that need to be considered if your back end is fully protected?

<comment><USER10> Imagine a link like this:

[https://example.com/login?vulernable- param=evilcredentialste...](https://example.com/login?vulernable- param=evilcredentialstealingjavascript\(\))

If I can convince a user to click that, and then login, I can steal their username, password or anything else. Basically anything they do in that window after clicking that link can be compromised.

<comment><USER11> Yes, but that gets passed to the server.

<comment><USER12> What about httsp://example.com/login#vulnerable-fragment

<comment><USER11> Yes, as i commented elsewhere in this thread that would be fine.

</comment></comment></comment></comment></comment><comment><USER13> I'm interested in the topic, but found the article quite disappointing. It doesn't really go into the technical details why we have a new wave of XSS vulns.

What I learned only recently: With many modern javascript frameworks many of the assumptions you may have had about XSS in the past are obsolete. The strategies that worked in the past - proper escaping of untrusted input - don't necessarily work any more if you're using something like angularjs.

<comment><USER4> This article was very much about the data we've collected and our analysis of it, as opposed to our opinions as to why - had to keep it to a reasonable length! So we kept that section short in the end. I do plan follow up posts that provide my theories as to why it's happening, and I think a best practices guide that discusses template-related XSS is a good idea. In the meantime, you can check out this related post: [https://snyk.io/blog/type- manipulation/](https://snyk.io/blog/type-manipulation/)

</comment></comment><comment><USER14> > AngularJS version 1, used at that point by approx. 30% of all websites

:) Something got quoted wrong there.

<comment><USER15> I think they misread a chart from their source, which shows 0.3% market share for AngularJS: [https://w3techs.com/technologies/history_overview/javascript...](https://w3techs.com/technologies/history_overview/javascript_library/all)

<comment><USER4> awkward typo there! Fixed now.

</comment></comment></comment><comment><USER16> IIRC the GitHub Open Source Survey noted that the people surveyed were more likely to trust OSS software in terms of security because of the transparency with vulnerabilities and the community surrounding it.

This article mentions increased use of OSS libs as a rising source of XSS. I'm really not sure what's worse - OSS that can be fixed and audited easily or proprietary software that's closed and lacking visibility.

<comment><USER17> OSS is no silver bullet - you still have to do your due diligence to have secure system. OSS just gives you an option to "fix it yourself".

Just recently I was reading a library and stumbled upon this interesting crypto tidbit [0] ("XXX get some random bytes instead"). Maybe a paid engineer would've designed it better but history is full of counter-examples (see CVE-2017-5689 [1]).

[0]: [https://github.com/nitram509/macaroons.js/blob/master/src/ma...](https://github.com/nitram509/macaroons.js/blob/master/src/main/ts/CryptoTools.ts#L61)

[1]: [https://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2017-5689](https://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2017-5689)

<comment><USER18> > OSS just gives you an option to "fix it yourself".

I would also say that _generally speaking_ you also get more eyes on your source code so you increase the likelihood that someone will find the flaw more quickly (although you could also say it's easier for bad actors to locate flaws to exploit too).

<comment><USER17> Well we are comparing apples and oranges here because this small open source repo most certainly have less people looking at it than Intel have engineers working on ME.

<comment><USER16> Who said this is a small open-source repo? Node.js has one of the most active OSS communities on the web, with many contributors and developers looking at the code, consuming and working on security and fixing bug reports daily.

Also, a single company provides limitations - you've got blinders on, and your project isn't open for those with a different perspective to come in and take a look and notice something. I honestly think that fresh, open, and global perspective is truly key the success of OSS.

<comment><USER19> Large communities of open source developers are no panacea, look at shellshock or all the various OpenSSL libs. Those bugs stayed present for years in highly used software...

A large community of devs who are focused on security would indeed be good for a projects security, but that's not always their number one priority.

</comment></comment></comment></comment></comment></comment><comment><USER20> The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities.

Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.

<comment><USER21> React by default has pretty good XSS protection. That being said, "don't trust the client" has been something developers have struggled with ever since we started writing client/server software.

<comment><USER22> Not just pretty good, I mean to show code unescaped you need to write `dangerouslySetInnerHTML`.

I think it's a common misconception, heavy-weight software usually does pretty well with common problems. If you think of frameworks like Rails which make input validation easy, writing manual SQL almost obsolete (SQL injection) and even CSRF protection happens mostly transparently.</comment></comment></comment>


Show HN: NEW Phaser Game X-LAB Colors - x-lab http://r2goo.com/S6K2y

<comment><AUTHOR> Mix primary colors to obtain secondary and tertiary, avoid the mouse labs and get to the last level.</comment>


Telnet Backdoor Opens More Than 1M IoT Radios to Hijack - <AUTHOR> https://threatpost.com/million-iot-radios-hijack-telnet-backdoor/148123/ <comment> java-man IoT, S stands for Security.</comment>


HN: Know of a telco with an API I can use to buy virtual phone numbers + query for logs? - <AUTHOR>

I'm building a directory services application and I need an API to buy virtual phone numbers on the fly, which will just forward to a different number. I'd also like to be able to query the API for the number of calls received and their duration. I'm predominantly interested in the USA and UK.<p>I'd be very grateful if somebody could point me in the right direction.. my google-fu seems weak today. <comment><USER2> I don't think they have an API, but www.voip.ms has been phenomenal for us. Really great design, great customer service, and CHEAP. Live chat them and see what they say, it would probably be easy just to hpricot a homebrew API with them.

<comment><AUTHOR> Thanks for the comment - they seem to have great prices and coverage.. and logs. Just what I was looking for!

</comment></comment><comment><USER3> Have you looked into the open source Telephony/PBX solution "Asterisk"? <http://www.asterisk.org/>

It does not exactly fit your requirement of an API to buy virtual phone numbers but I believe you should be able to use it to cheaply setup forwarding service for phone numbers. I am not speaking out of experience but I think Asterisk might be able to do what you are looking for.

<comment><AUTHOR> Yeah the main problem is buying the actual numbers. We don't have a very complex requirement in terms of managing the calls - they'll all just get forwarded on to different numbers, so we don't really need to manage our own infrastructure.

</comment></comment><comment><USER4> I don't know if it does quite what you want, but Twilio.com is worth checking out/asking if you haven't.

<comment><AUTHOR> Thanks for the comment - the site seems a little sparse on information but I've sent them an e-mail.</comment></comment>


Doomed Programming Languages - <AUTHOR> https://insights.dice.com/2019/07/29/5-programming-languages-probably-doomed/ <comment><USER2> Please restore the original article title which sound less dramatic "5 Programming Languages That Are Probably Doomed"</comment>


Playing Pacman with gestures using Python and OpenCV - <AUTHOR> https://medium.com/@vipul_sharma/playing-pacman-with-gestures-python-opencv-f498306b24fa <comment><USER2> this is awesome ! :)

<comment><AUTHOR> Thanks :)</comment></comment>


Ask HN: How do you get over perfectionism/overthinking in hobby projects? - <AUTHOR> I have many empty repositories at Github which were supposed to be ML softwares. The reason is that whenever I started to write code, I was obsessed with making it abstract, extendable, modular, easy-to-read, ... (Rare thing among ML softwares) So most of my time was spent on designing modules without writing any actual ML code! And then I got disappointed and let it go. Any suggestion on how to cool down this obsession so I can write at least some actual working code for god sake? <comment><USER2> I used to engage in a lot of yak shaving (needless refactors, redesigns, etc), but I never actually shipped anything. I was tired of having a big pile of unfinished projects, so I forced myself to take a more waterfall-y approach to some smaller projects: define the requirements and build only what is needed to meet those requirements. Once it's shipped, I allow myself to look at biting off another chunk of work, but until that chunk of work is done, I'm not doing _anything_ else.

<comment><USER3> The important thing here is:

      until that chunk of work is done, I'm not doing anything else.

Multitasking means you'll take longer to ship anything, though the total time spent to ship everything may be the same. By selecting smaller units of work and focusing on them to completion you can reduce the overall latency of the system.

This doesn't even mean Waterfall (big design up front). Agile workflows operate on this same principle. If you elected a Scrum-styled approach you'd select the work for the current Sprint and run it to completion. If you elected for a Kanban-styled approach, you'd look at how many things are in each stage of completion and stop inducting new work when you realize you have 20 projects that are all at the "refactor for publishing" stage.

</comment></comment><comment><USER4> Will anyone else notice?

When I am doing DIY I always want it to be perfect, because I know the project inside out. I know where I had to cut a corner or where some ends didn't quite meet and had to be filled, where a seam isn't as invisible as I would like. To stop myself obsessing over the tiny details I ask myself, will my wife notice it? If she would then it's worth spending a bit more time on, if she wouldn't notice it, do the best you can and move on with more important jobs. Once the job is finished I can go back to that little issue that only I know about and tweak it so it is better.

In software just build it, make it do the minimum required however you can and then tidy it up and make it extendable/modular etc.

<comment><AUTHOR> I guess yes. I recently found out that some part of my motivations about doing things has been getting feedback from people (It releases dopamine and makes you feel validated). I used to be a software engineer and I'm somehow obsessed with designing software architectures with minimum cost of change in future. It makes me crazy to design something on-the-fly without considering the cost of changes. That's the reason I have obsession for writing general-purpose abstract codes... It really makes me crazy but I don't know what to do with it...

<comment><USER4> Getting feedback is good, but you want feedback on what the product does, not how it does it.

Personally I prefer to get feedback that tells me why something I did was the wrong way as long as I also get told why and what the correct way would be. That way I can improve my software and learn something at the same time. Being told my solution is e.g elegant, is nice in the short term but less helpful in the long term

</comment></comment></comment><comment><USER5> I can't speak for any projects related to software, but I am a hobbyist musician and have just last year started writing songs, I've joined bands for open mic nights, etc... I have a strong perfectionist streak and used to become very frustrated when I could hear small mistakes or if any facet of a project wasn't shaping up in real life as well as it had in my head.

To fix my frustration and increase my output, I focused on:

1) Changing my anticipation of a reward from the perfection of the project to the completion of the project. This required me to actively tell myself "this isn't that good, put I'm executing regardless". Being able to tell my friends "hey, I wrote this song" is better than being able to say "hey, I've got this great idea for a song", but it didn't more satisfying until I had written a bunch of songs (quite a few of which weren't good).

2) Anticipating the reaction to the project from people who don't know the details rather than the reaction to the project from the experts. An amateur barbershop quartet may sound medium-talent in the eyes of a vocal professional (who I was initially working to impress), but it's fun and sounds great to the average person at an open mic (who I started working to impress).

Other tips:

\- Rather than trying to implement perfectionist ideas in the moment, note them down and continue making an imperfect project. Once you've got something done, you can look at your perfectionist notes and decide whether or not to go back and fix/rewrite. This is how I finish scripts for plays and new compositions.

\- Adopt the mindset intended by this reddit anecdote I'm paraphrasing: "You're 30 and you can't play guitar. Yeah, you missed the window of time where you could have been a great professional guitarist at a young age, but ten years from now you're going to be 40, and you can either have spent 10 years practicing guitar, or you can have spent 10 years regretting how you didn't become the best guitarist it was possible to be and imagining how it could have been different". Apply to coding as necessary.

<comment><USER6> Seconded to the max. Being able to finish things is a more important ability than being able to do things perfectly. In my 30's, I put aside the pursuit of perfection in favor of developing the discipline to finish with acceptable results. It's the second most important improvement I have made in my life.

<comment><USER5> What was the first?

<comment><USER6> That I am a human being, like all the other humans, and not a robot or machine. I was hard on myself, and by consequence, hard on others. Learning to be easier on myself allowed me to learn how to complete good, worthwhile things without damaging myself or others.

</comment></comment></comment></comment><comment><USER7> From a hardware perspective, I spent wayyyy too much time re-wiring breadboard circuits with perfectly measured and cut lengths of wire to make them look "beautiful," turning something like this[0] into this[1].

That was a waste of time. Both have the same result, but the ratsnest is always faster. The goal isn't beauty, it's meeting the requirements. The pretty one might be a little easier to debug and transcribe into a schematic for PCB layout and for someone else to understand, but IMO breadboarding isn't the right time for that.

[0] [https://upload.wikimedia.org/wikipedia/commons/thumb/4/47/Br...](https://upload.wikimedia.org/wikipedia/commons/thumb/4/47/Breadboard_complex.jpg/1200px- Breadboard_complex.jpg)

[1] [https://imgur.com/zlyHs](https://imgur.com/zlyHs)

<comment><USER8> > _Both have the same result, but the ratsnest is always faster._

I simulate as much as I can (e.g using LTSpice) and then go straight to circuit board (DIY at home laser/LED printer toner transfer). Mucking around with unreliable breadboards isn't much fun.

It's too easy to make mistakes and bad connections in breadboard layouts. Then if it's not working, you have to figure out whether it's the circuit, a mistake in the assembly, or a bad connection.

If I'm going to go to PCB anyway, might as well route that and use it from the get go.

<comment><USER9> sorry for sounding green, but I've been tinkering in electronics, and PCB design is has been the part that's daunting.

I would prefer to make PCBs, but how do you handle the footprint of some components? like do you measure each one and then design it in eagle?

<comment><USER10> The datasheet for the components almost always describe the dimensions and often the recommended footprint (landing zone). Depending on the industry different additional standards apply (for example "space grade" have increased focus on reliability; mobile devices on area reduction; etc)

CAD packages ship with or have collections of common footprints, but be aware that there aren't truly standards and two footprints might be named the same but have quite different dimensions (even within a single manufacturer). It is rare but it happens and thus it is worth checking.

KiCAD has a large repository of common footprint layouts which I believe is of a reasonable quality, but I have never used them myself.

</comment></comment></comment></comment><comment><USER11> Don't put it publicly on GitHub from the start (=less worry about "what if someone sees my ugly code?!"). Go to something working on more or less the shortest path possible, and then extend it step by step, introducing abstraction only when you actually need it.

<comment><USER12> I wouldn't worry about it at all. Nobody reads nor cares about your ugly code.

<comment><USER11> Easier said than done if you're worrying about it anyways, which I suspected OP might do.

</comment></comment></comment><comment><USER13> Honestly, it depends on the project and why I'm building it.

If I'm building something because I want to learn something new, I give myself permission to spend as much time massaging it as I want. For me, being able to chase 'perfect' is an important part of my learning process.

On the other hand, if I'm building something I want to ship, I like to set rabbit hole alarms. Whenever I sense that I'm about to start going down the winding road of obsession, I set a timer (usually for half an hour). I let my mind go wild until the timer goes off, then I move onto the next task.

</comment><comment><USER14> This is what I do:

1\. Meditate every day

2\. I have the following text file on my desktop. Answer the questions before you start, then start, and do nothing else but the steps listed for the amount of time listed.

What are my steps?

Why accomplish this?

Provide a conductive environment: (Make a list here of actions to take to get you ready to start (bathroom, water, close door, close other programs, etc.))

What length of continuous time will I work on this?

Doing step 2 has always worked when I actually fill out the answers.

<comment><USER15> Any practical recommendations on how to get into a daily meditation habit. Do you use an app like Headspace? Any special mind hacks you use?

<comment><USER14> I greatly prefer silent meditation. People prefer different things, so ymmv.

My advice is to carve out 30 minutes in the morning and just start. Pick a focus; most people pick a sensation of breathing. While focusing on this, observe what your mind and body do, without reacting to it, and without judging it or yourself. When your attention wanders, re-focus it without judgement. This will happen a lot, noticing your attention wandering and re- focusing is part of the practice. It will happen less and less over time.

There are no mind hacks, but here are some things that might be helpful to look out for. These are things to verify for yourself through direct insight: don't take my word for it.

* Your thoughts are not actually part of your identity. _You_ are not your thoughts, judgements, emotions, etc. The "voice in your head" is not you.

* Most people actually see and live in a landscape of subjective thoughts based on reality, instead of seeing and living in reality directly.

* People are primarily harmed not by events, but by their reaction to the events.

</comment></comment></comment><comment><USER16> I had this problem myself. My solution: focus on agile, feature-driven development. Make the next feature work in a scrappy (ie exploratory coding) way, then take what you learned and refactor. Don't take it as an opportunity to refactor everything - just the code around that one feature, and close relatives e.g. common functionality that can be abstracted out.

Presumably you're working on your software for a reason - not just to press keys for hours on end. So focus on getting the software ready to fulfil that purpose and don't get so caught up on software engineering practices. Most best practices in software engineering are solely there to allow large teams to work on a single codebase anyway (especially so for extensibility and modularity) and that doesn't apply to your project so why would you follow them?

</comment><comment><USER12> There's nothing wrong with having good workmanship in the things you produce. More so for the things you enjoy doing.

If you _enjoy_ writing these abstractions, then knock yourself out. You said "hobby", right?

Personally, I'm slightly against this type of thing.. abstractions/modularity for the sake of it. An abstraction for a single concrete thing is actually less readable. A good goal would be to design/write so it can be abstracted later (if required).

GoF is an excellent guide, but it's not a rule-book.

</comment><comment><USER17> Perfect is the enemy of good enough</comment>


Birds can see Earth's magnetic fields because of cryptochromes in their eyes - <AUTHOR> https://www.sciencealert.com/birds-see-magnetic-fields-cryptochrome-cry4-photoreceptor <comment><USER2> I'm not sure why, but the few times in high-school that I took acid, I could see lines in the night sky going north to south. It was deterministic, like clock work.

Does anybody have an ideas why? I mean, I wasn't really hallucinating, I didn't take too much. I could always truely find north or south. I couldn't tell what was north or south, but I could draw the line, always.

Am I crazy? I mean, I'm not saying I'm a bird, but...

<comment><USER3> Even if you could see magnetic fields, it wouldn't look like lines in the sky running north to south, so this does sound like an hallucination.

<comment><USER4> So what would a magnetic field look like (to the naked eye, not just a visualisation of field lines with iron filings or similar) if you could see it?

<comment><USER5> Well, I imagine the crystals can only perceive single vector values of the magnetic field at the position of the eye. Imagine each censor returning a vector defining the magnetic field at a point on the eye. There probably wouldn't be any way to focus or change depth of perception like one could with light. You'd have to move your eyes through space to get more than a localized snapshot.

But, you can probably predict what a magnetic field looks like away from the point of measurement, I.e. the eye. What is fascinating to me is that they could potentially be learning to deal with manmade magnetic fields, adapting to human culture in a possibly novel way.

</comment></comment></comment></comment><comment><USER6> _grep "power line"_

...am I really the only one who thought about whether this might contribute to why power lines are so attractive for birds to perch on?

<comment><USER7> I suspect the magnetic field around a power line is thousands of times more powerful than earth's magnetic field.

It would likely overload the birds senses and not be a pleasant experience.

<comment><USER8> Their perception could be non linear, much like our perception of light intensity. Or it might be adjusted automatically to a higher value, dimming the earth's field but making power lines "bright" but not blinding.

What a cool possibility overall!

<comment><USER9> There's a difference with power lines because it runs an AC current. The earths magnetic field is static for all intents and purposes.

</comment></comment></comment></comment><comment><USER10> I wonder if they would perceive unnatural magnetic fields, particularly small, strong fields as something strange enough to avoid?

If so, I wonder if one could discourage birds from hitting windows by arranging for a strong magnetic field outside the window?

There are ways to discourage birds from flying into windows, but they often make the window less useful to humans.

<comment><USER11> Or keep them away from airports.

<comment><USER12> Eagles are very good avoiding planes and working as airport security buddies.

</comment></comment></comment><comment><USER13> This raises some interesting questions for me.

First since I've been doing some Software radio stuff of late, I'm wondering if there is a way to build a chemical detector for magnetic fields that would allow one to pick up signals without a giant magnetic loop antenna. The paper (linked in another comment) suggests that the frequency response is low (1uS to 100uS) so it would not be a high bandwidth link :-).

The other is what happens when the poles swap?[1] Do the birds commit mass suicide as they fly north for the winter and south for the summer?

[1] [https://www.extremetech.com/extreme/192522-earths- magnetic-f...](https://www.extremetech.com/extreme/192522-earths-magnetic- field-could-flip-within-our-lifetime-but-dont-worry-we-should-be-ok)

<comment><USER14> Geomagnetic reversal is not some atomic event but a gradual process lasting for several kY. Different parts of the Earth are in different stages of of the reversal, some further along than others. [https://en.wikipedia.org/wiki/South_Atlantic_Anomaly](https://en.wikipedia.org/wiki/South_Atlantic_Anomaly)

<comment><USER13> "Atomic" no, but there is evidence it isn't kY either. The article I linked was one of many that discussed the implications of the paper "Extremely rapid directional change during Matuyama-Brunhes geomagnetic polarity reversal" [1] published in 2014. In that paper, the authors studied different Lava flows that suggested a reversal can happen in a single human lifetime, with a change as rapid as 6 degrees per day.

I believe that a polarity change in fewer than 100 generations would be challenging for most species that see or use the magnetic field to adapt.

[1] [https://academic.oup.com/gji/article/199/2/1110/618671](https://academic.oup.com/gji/article/199/2/1110/618671)

</comment></comment></comment><comment><USER15> Is there practical expirementsl evidence demonstrating birds can sense magnetic fields? That is, can you train a bird to select between two boxes, one of which contains a strong magnet?

Just wondering. I'd read about theories regarding iron in the beaks and whatnot. Sounds cruel, but why not (a) train the bird to select the magnet, then (b) remove beak and check if it can still do the trick, or (c) remove eyes and see if it can still do the trick.

I'm not entirely sure, though, that (a) has been accomplished. Can't find anything on it.

<comment><USER16> maybe just blindfold the bird, instead of removing the eyes

<comment><USER17> Don't most bird just go to sleep when blindfolded ? Or is it just an idea that got in my mind ?

<comment><USER18> They don't tend to actually sleep. They do become more docile, because they can't see to fly without risking hitting something.

<comment><USER17> Thinking about it, it was pretty dumb on my part. I know about hunting birds, I should have thought about that.

</comment></comment></comment></comment></comment><comment><USER19> I wonder if the Earths magnetic field flipping every half a Million years affects birds untowardly? Or have they evolved to deal with it?

<comment><USER20> If the images in the article are accurate, the birds don't really see the polarity of the field, merely the alignment, so they don't really see "north", "east", "south" and "west", merely "latitudinal" or "longitudinal".

They would probably combine with sunlight to get the real orientation – an approach which would continue to work with a flipped magnetic field.

<comment><USER21> If you have 3D polarized glasses from the cinema you can go outside on a sunny day see this alignment in the sky. It's really cool, highly recommended.

<comment><USER22> You can see it with the naked eye, too, near the center of your vision.

[https://en.wikipedia.org/wiki/Haidinger%27s_brush](https://en.wikipedia.org/wiki/Haidinger%27s_brush)

</comment></comment></comment></comment><comment><USER23> If you liked this story, I recommend you "Life on the Edge: The Coming of Age of Quantum Biology".

[https://www.amazon.com/Life-Edge-Coming-Quantum- Biology/dp/0...](https://www.amazon.com/Life-Edge-Coming-Quantum- Biology/dp/0307986829)

</comment><comment><USER24> This is really hard to understand in terms of how the eye works. Conventional sight works by detecting photons hitting the retina. But "seeing" a magnetic field seems like it would only work when the eye is literally inside of the field. Magnetic fields don't project or reflect off of things, they are where they are. The eye would have to be directly affected by the field to see it.

And then they wouldnt be able to see parts of the field they are not currently in. Magnetic fields don't radiate anything, they ARE the radiation. It's like trying to see a laser that is not pointed at your eye. It's there, but it cant be detected because no photons from it are hitting your eye.

<comment><USER25> you can see a laser that is not pointed at your eyes. Use fog.

The atmosphere is known to diffuse the vectors of electromagnetic radiation. That's how we get blue skies and red sunsets. Who says it's not having the same effect on earth's magnetic fields

<comment><USER24> You are kind of proving my point though. With fog, you can see the laser because photons are bouncing off the fog and hitting your eye. This article isn't saying that photons are bouncing the magnetic fields and then hitting their eyes, they are saying the eyes can literally detect magnetic fields. If the birds were seeing magnetic fields via how they interact with photons, then everyone would be able to 'see' magnetic fields because we can all see photons. This is saying that the magnetic fields are directly visible by birds.

<comment><USER25> I'm aware that photons have to physically interface with the retina to be seen. You're missing my point. Earth's atmosphere acts like the fog as a laser travels through it — it diffuses the vectors, making them visible to an observer not along the path from the light source. When you look up at the clear sky during the day you don't see the sun and then pure black space (and stars).

Likewise the effects of the magnetic field interface with earth's atmosphere.

For example Earth's magnetic field deflects solar wind. The solar wind interacting with the magnetic field transfers some of its energy into earth's atmosphere.

</comment></comment></comment></comment><comment><USER26> Could someone please explain the physics in respect of how blue light and magnetic fields measurably interact with this protein?

<comment><USER27> It's actually linked in the article, this explains more about the working theory they have [https://physicsworld.com/a/birds-measure-magnetic-fields- usi...](https://physicsworld.com/a/birds-measure-magnetic-fields-using-long- lived-quantum-coherence/)

</comment></comment><comment><USER28> title was not click bait. they can actually see it. nice. can't wait for the bodymod crowd to catch up on that one

<comment><USER29> They've already managed to use CRISPR to give color blind primates their full vision back...

[http://www.neitzvision.com/research/gene- therapy/](http://www.neitzvision.com/research/gene-therapy/)

</comment></comment><comment><USER30> > Whoa, evolution. Just... whoa.

At some point this really starts to sound ridiculous.

</comment><comment><USER31> What is it like to see a magneric field?

Because it's in their eyes, it would have a visual interpretation. And some evolutionary advantage to that visual advantage, else the cells could be anywhere (unless there's a biochemical similarity to cones?)

However, a field isn't like photons hitting the retina. It would probably be a new colour, which we can't imagine, but I'm asking where that colour would appear, to indicate the field.

Perhaps a faint fog, varying in strength with direction - like the sky at dusk and dawn.

<comment><USER3> There are some speculative illustrations at the bottom of the article.

</comment></comment><comment><USER21> If you have 3D polarized glasses from the cinema you can go outside on a sunny day see this alignment in the sky. It's really cool, highly recommended

<comment><USER3> That's not a magnetic field, that's polarisation of the light in the sky due to scattering.

</comment></comment><comment><USER32> Slightly off topic, but I am so thankful for firefox's reader. The amount of annoying ads blinking/flashing is enough to drive me up a wall

<comment><USER33> You should try Firefox's tracking protection. This was actually one page I _didn 't_ use reader view for!

</comment></comment><comment><USER34> Can anyone explain in layperson terms how this is different from regular old polarization?

<comment><USER35> Light travels from one point to another in a direction.

Perpendicular to that direction light "wiggles" on it's way from origin to destination.

The direction of the 'wiggle' is the polarization of the light.

Unpolarized light wiggles in every direction while polarized light only wiggles in one.

Certain things (like how the sun shines on the sky) creates polarized light naturally.

The earth's magnetic field DOES NOT polarize light.

Birds have a protein in their eyes that uses blue light + the earths magnetic field to visualize the magnetic field around them.

Similar to visualizing the polarity of light, we lack the ability to visualize magnetic fields, making both foreign concepts.

</comment></comment><comment><USER36> I've heard people can too if they look at the sky under the right conditions.

<comment><USER37> [https://en.wikipedia.org/wiki/Haidinger%27s_brush](https://en.wikipedia.org/wiki/Haidinger%27s_brush) is a real and really cool phenomenon, but it detects light polarization, not magnetic orientation.

<comment><USER36> Does the polarization of the light in sky correspond with the poles of the earth? If so, since the effect has direction, wouldnt you have a compass in the sky?

I was just able to see the effect for the first time using this image [1] full screen on my phone :) Brightness up, screen rotation off, hold out the phone and turn it like your steering a car. Jumped right out at me. It's always at the center of my vision, so if I look around the screen as I'm turning, it follows. The yellow always points to the longer edges of my phone. It's hard to hold it in view when not turning though.

[1] [http://www.solidbackgrounds.com/images/2560x1600/2560x1600-v...](http://www.solidbackgrounds.com/images/2560x1600/2560x1600-vivid- sky-blue-solid-color-background.jpg)

<comment><USER36> Looks like the polarization in the sky coresponds to the sun, not the poles. [https://mysite.du.edu/~jcalvert/optics/haiding.htm](https://mysite.du.edu/~jcalvert/optics/haiding.htm)

</comment></comment></comment></comment><comment><USER38> So couple this with evolution and you have migration, no?

<comment><USER39> Probably migration existed first, but those with the ability to see the magnetic field were much more successful at migrating, probably due to expending less energy during.

</comment></comment><comment><USER40> If birds can figure out how to have blockchain based browsers embedded in their eyes to help with navigation, why can't we just copy that tech for our own uses?

Can we do an Initial Cryptochrome Offering?

</comment><comment><USER41> I would love to add this ability.

</comment><comment><USER35> Flagging for a title change, perhaps:

"Birds can see Earth's magnetic fields due to protein in their eyes"

or the original, more clickbait-y title:

"Birds Can See Earth's Magnetic Fields, And We Finally Know How That's Possible"

<comment><USER42> Seems to me the first part of the title makes a reasonable whole title, so let's go with that for now.

Also, we changed the URL from [http://archive.is/SlcSL](http://archive.is/SlcSL). archive.is is an excellent site for archiving, but not for HN submitting, because it's important for readers to see the actual domain. For the same reason, we don't allow link shorteners.

<comment><USER43> The eye link to magnetic field navigation has been known for years; the mechanism has not been.

<comment><USER42> Ok, we've put some cryptochromes in the title.

</comment></comment></comment></comment><comment><USER44> Cryptochromes? Will there be an ICO?

</comment><comment><USER45> Crypto birds? I'm in

</comment><comment><USER46> Cryptoc.. what? Crypto?! Sir when ICO?

</comment><comment><USER47> Is it bad that I first thought of the electric scooter company Bird?

</comment><comment><USER48> If the cryptocrome mechanism is real, that's pretty spectacular. I thought that the idea of magnetoreception was mostly abandoned in favor of visual navigation, but I was wrong.

</comment><comment><USER49> Cryptochromes? That sounds like Google launched a cryptocurrency. These birds are mining Cryptocurrency using Magnetic fields. LOL!</comment>